Content-Security-Policy

sentry.io sends an enforcing CSP. It is nonce-based and uses 'strict-dynamic'.

upgrade-insecure-requests; default-src 'none'; script-src 'strict-dynamic' 'nonce-Q18S3mh3G3GcLuFNIIfVYUhJ8o8yvNFe' 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' *.sentry.dev www.googletagmanager.com plausible.io player.vimeo.com prod-assets.sequelvideo.com; connect-src 'self' sentry.io *.sentry.io *.sentry.dev reload.getsentry.net www.google.com unpkg.com vimeo.com plausible.io *.sequelvideo.com *.sequel.io; img-src 'self' sentry.io *.sentry.io data: *.sentry.dev storage.googleapis.com sentry-blog.storage.googleapis.com www.googletagmanager.com i.vimeocdn.com images.ctfassets.net images.lumacdn.com *.sequelvideo.com *.cloudinary.com; style-src 'self' 'unsafe-inline' *.sentry.dev; media-src 'self' videos.ctfassets.net; font-src 'self' *.sentry.dev data: fonts.gstatic.com; frame-src player.vimeo.com demo.arcade.software recaptcha.google.com www.google.com *.sequel.io *.sequelvideo.com; manifest-src 'self' *.sentry.dev; base-uri 'none'; frame-ancestors *.sentry.io; report-uri https://o1.ingest.sentry.io/api/1297627/security/?sentry_key=e811b9077ef64dcf8a279ec18a61b222

Directive	Sources
upgrade-insecure-requests	(empty)
default-src	'none'
script-src	'strict-dynamic' 'nonce-Q18S3mh3G3GcLuFNIIfVYUhJ8o8yvNFe' 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' *.sentry.dev www.googletagmanager.com plausible.io player.vimeo.com prod-assets.sequelvideo.com
connect-src	'self' sentry.io *.sentry.io *.sentry.dev reload.getsentry.net www.google.com unpkg.com vimeo.com plausible.io *.sequelvideo.com *.sequel.io
img-src	'self' sentry.io *.sentry.io data: *.sentry.dev storage.googleapis.com sentry-blog.storage.googleapis.com www.googletagmanager.com i.vimeocdn.com images.ctfassets.net images.lumacdn.com *.sequelvideo.com *.cloudinary.com
style-src	'self' 'unsafe-inline' *.sentry.dev
media-src	'self' videos.ctfassets.net
font-src	'self' *.sentry.dev data: fonts.gstatic.com
frame-src	player.vimeo.com demo.arcade.software recaptcha.google.com www.google.com *.sequel.io *.sequelvideo.com
manifest-src	'self' *.sentry.dev
base-uri	'none'
frame-ancestors	*.sentry.io
report-uri	https://o1.ingest.sentry.io/api/1297627/security/?sentry_key=e811b9077ef64dcf8a279ec18a61b222

Headers sent

Header	Value
strict-transport-security	max-age=31536000; includeSubDomains; preload
server	nginx
access-control-allow-origin	*

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan